# Basic auth : "exception" with bad username / password and response is empty **URL:** \ **Category:** Search Guard\ **Created:** [June 15, 2016, 4:17pm UTC](https://forum.search-guard.com/t/basic-auth-exception-with-bad-username-password-and-response-is-empty/197 "2016-06-15T16:17:18Z")\ **Posts on this page:** 2\ **Page:** 1
**Author:** ![ll1](https://avatars.discourse-cdn.com/v4/letter/l/da6949/32.png) [@ll1](https://forum.search-guard.com/u/ll1)\ **Post date:** [June 15, 2016, 4:17pm UTC](https://forum.search-guard.com/t/basic-auth-exception-with-bad-username-password-and-response-is-empty/197/1 "2016-06-15T16:17:18Z")
Hello, I’m trying to setup search-guard right now, basic auth is working but if I use wrong username or password I have this into elasticsearch.log : > [2016-06-15 18:21:16,302][ERROR][com.floragunn.searchguard.auth.BackendRegistry] Unexpected exception com.google.common.util.concurrent.UncheckedExecutionException: ElasticsearchSecurityException[dsqdksqlk not found] > com.google.common.util.concurrent.UncheckedExecutionException: ElasticsearchSecurityException[dsqdksqlk not found] > at com.google.common.cache.LocalCache$Segment.get(LocalCache.java:2203) > at com.google.common.cache.LocalCache.get(LocalCache.java:3937) > at com.google.common.cache.LocalCache$LocalManualCache.get(LocalCache.java:4739) > at com.floragunn.searchguard.auth.BackendRegistry.authenticate(BackendRegistry.java:379) > at com.floragunn.searchguard.filter.SearchGuardRestFilter.process(SearchGuardRestFilter.java:54) > at org.elasticsearch.rest.RestController$ControllerFilterChain.continueProcessing(RestController.java:263) > at org.elasticsearch.rest.RestController.dispatchRequest(RestController.java:176) > at org.elasticsearch.http.HttpServer.internalDispatchRequest(HttpServer.java:128) > at org.elasticsearch.http.HttpServer$Dispatcher.dispatchRequest(HttpServer.java:86) > at org.elasticsearch.http.netty.NettyHttpServerTransport.dispatchRequest(NettyHttpServerTransport.java:449) > at org.elasticsearch.http.netty.HttpRequestHandler.messageReceived(HttpRequestHandler.java:61) > at org.jboss.netty.channel.SimpleChannelUpstreamHandler.handleUpstream(SimpleChannelUpstreamHandler.java:70) > at org.jboss.netty.channel.DefaultChannelPipeline.sendUpstream(DefaultChannelPipeline.java:564) > at org.jboss.netty.channel.DefaultChannelPipeline$DefaultChannelHandlerContext.sendUpstream(DefaultChannelPipeline.java:791) > at org.elasticsearch.http.netty.pipelining.HttpPipeliningHandler.messageReceived(HttpPipeliningHandler.java:60) > at org.jboss.netty.channel.SimpleChannelHandler.handleUpstream(SimpleChannelHandler.java:88) > at org.jboss.netty.channel.DefaultChannelPipeline.sendUpstream(DefaultChannelPipeline.java:564) > at org.jboss.netty.channel.DefaultChannelPipeline$DefaultChannelHandlerContext.sendUpstream(DefaultChannelPipeline.java:791) > at org.jboss.netty.handler.codec.http.HttpChunkAggregator.messageReceived(HttpChunkAggregator.java:145) > at org.jboss.netty.channel.SimpleChannelUpstreamHandler.handleUpstream(SimpleChannelUpstreamHandler.java:70) > at org.jboss.netty.channel.DefaultChannelPipeline.sendUpstream(DefaultChannelPipeline.java:564) > at org.jboss.netty.channel.DefaultChannelPipeline$DefaultChannelHandlerContext.sendUpstream(DefaultChannelPipeline.java:791) > at org.jboss.netty.handler.codec.http.HttpContentDecoder.messageReceived(HttpContentDecoder.java:108) > at org.jboss.netty.channel.SimpleChannelUpstreamHandler.handleUpstream(SimpleChannelUpstreamHandler.java:70) > at org.jboss.netty.channel.DefaultChannelPipeline.sendUpstream(DefaultChannelPipeline.java:564) > at org.jboss.netty.channel.DefaultChannelPipeline$DefaultChannelHandlerContext.sendUpstream(DefaultChannelPipeline.java:791) > at org.jboss.netty.channel.Channels.fireMessageReceived(Channels.java:296) > at org.jboss.netty.handler.codec.frame.FrameDecoder.unfoldAndFireMessageReceived(FrameDecoder.java:459) > at org.jboss.netty.handler.codec.replay.ReplayingDecoder.callDecode(ReplayingDecoder.java:536) > at org.jboss.netty.handler.codec.replay.ReplayingDecoder.messageReceived(ReplayingDecoder.java:435) > at org.jboss.netty.channel.SimpleChannelUpstreamHandler.handleUpstream(SimpleChannelUpstreamHandler.java:70) > at org.jboss.netty.channel.DefaultChannelPipeline.sendUpstream(DefaultChannelPipeline.java:564) > at org.jboss.netty.channel.DefaultChannelPipeline$DefaultChannelHandlerContext.sendUpstream(DefaultChannelPipeline.java:791) > at org.elasticsearch.common.netty.OpenChannelsHandler.handleUpstream(OpenChannelsHandler.java:75) > at org.jboss.netty.channel.DefaultChannelPipeline.sendUpstream(DefaultChannelPipeline.java:564) > at org.jboss.netty.channel.DefaultChannelPipeline.sendUpstream(DefaultChannelPipeline.java:559) > at org.jboss.netty.channel.Channels.fireMessageReceived(Channels.java:268) > at org.jboss.netty.channel.Channels.fireMessageReceived(Channels.java:255) > at org.jboss.netty.channel.socket.nio.NioWorker.read(NioWorker.java:88) > at org.jboss.netty.channel.socket.nio.AbstractNioWorker.process(AbstractNioWorker.java:108) > at org.jboss.netty.channel.socket.nio.AbstractNioSelector.run(AbstractNioSelector.java:337) > at org.jboss.netty.channel.socket.nio.AbstractNioWorker.run(AbstractNioWorker.java:89) > at org.jboss.netty.channel.socket.nio.NioWorker.run(NioWorker.java:178) > at org.jboss.netty.util.ThreadRenamingRunnable.run(ThreadRenamingRunnable.java:108) > at org.jboss.netty.util.internal.DeadLockProofWorker$1.run(DeadLockProofWorker.java:42) > at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142) > at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617) > at java.lang.Thread.run(Thread.java:745) > Caused by: ElasticsearchSecurityException[dsqdksqlk not found] > at com.floragunn.searchguard.auth.internal.InternalAuthenticationBackend.authenticate(InternalAuthenticationBackend.java:94) > at com.floragunn.searchguard.auth.BackendRegistry$4.call(BackendRegistry.java:383) > at com.floragunn.searchguard.auth.BackendRegistry$4.call(BackendRegistry.java:379) > at com.google.common.cache.LocalCache$LocalManualCache$1.load(LocalCache.java:4742) > at com.google.common.cache.LocalCache$LoadingValueReference.loadFuture(LocalCache.java:3527) > at com.google.common.cache.LocalCache$Segment.loadSync(LocalCache.java:2319) > at com.google.common.cache.LocalCache$Segment.lockedGetOrLoad(LocalCache.java:2282) > at com.google.common.cache.LocalCache$Segment.get(LocalCache.java:2197) > … 47 more > [2016-06-15 18:21:16,302][INFO][com.floragunn.searchguard.auth.BackendRegistry] Cannot authenticate user (or add roles) with ad 0 due to ElasticsearchSecurityException[com.google.common.util.concurrent.UncheckedExecutionException: ElasticsearchSecurityException[dsqdksqlk not found]]; nested: UncheckedExecutionException[ElasticsearchSecurityException[dsqdksqlk not found]]; nested: ElasticsearchSecurityException[dsqdksqlk not found];, try next As you can see “Unexpected exception” is sent and elasticsearch respond an empty body and header. I think if user or password not match, plugin should ask again for new credentials and send back correct answer like http 401… Here my sg\_config.yml : > searchguard: > dynamic: > http: > anonymous\_auth\_enabled: false > xff: > enabled: false > internalProxies: ‘192.168.0.10|192.168.0.11’ # regex pattern > #internalProxies: ‘._’ # trust all internal proxies, regex pattern > remoteIpHeader: ‘x-forwarded-for’ > proxiesHeader: ‘x-forwarded-by’ > #trustedProxies: '._’ # trust all external proxies, regex pattern > ###### see [Pattern (Java Platform SE 7 )](https://docs.oracle.com/javase/7/docs/api/java/util/regex/Pattern.html) for regex help > ###### more information about XFF [X-Forwarded-For - Wikipedia](https://en.wikipedia.org/wiki/X-Forwarded-For) > ###### and here [RFC 7239 - Forwarded HTTP Extension](https://tools.ietf.org/html/rfc7239) > ###### and [Apache Tomcat 8 Configuration Reference (8.0.53) - The Valve Component](https://tomcat.apache.org/tomcat-8.0-doc/config/valve.html#Remote_IP_Valve) > authc: > kerberos\_auth\_domain: > enabled: false > order: 0 > http\_authenticator: > type: kerberos # NOT FREE FOR COMMERCIAL USE > challenge: true > config: > # If true a lot of kerberos/security related debugging output will be logged to standard out > krb\_debug: false > # Acceptor (Server) Principal name, must be present in acceptor\_keytab\_path file > acceptor\_principal: ‘HTTP/localhost’ > # If true then the realm will be stripped from the user name > strip\_realm\_from\_principal: true > authentication\_backend: > type: noop > basic\_internal\_auth\_domain: > enabled: true > order: 0 > http\_authenticator: > type: basic > challenge: true > authentication\_backend: > type: intern > proxy\_auth\_domain: > enabled: false > order: 2 > http\_authenticator: > type: proxy > challenge: false > config: > user\_header: “x-proxy-user” > roles\_header: “x-proxy-roles” > authentication\_backend: > type: noop > clientcert\_auth\_domain: > enabled: false > order: 4 > http\_authenticator: > type: clientcert > challenge: false > authentication\_backend: > type: noop > ldap: > enabled: false > order: 3 > http\_authenticator: > type: basic > challenge: false > authentication\_backend: > # LDAP authentication backend (authenticate users against a LDAP or Active Directory) > type: ldap # NOT FREE FOR COMMERCIAL USE > config: > # enable ldaps > enable\_ssl: false > # enable start tls, enable\_ssl should be false > enable\_start\_tls: false > # send client certificate > enable\_ssl\_client\_auth: false > # verify ldap hostname > verify\_hostnames: true > hosts: > - localhost:8389 > bind\_dn: null > password: null > userbase: ‘ou=people,dc=example,dc=com’ > # Filter to search for users (currently in the whole subtree beneath userbase) > # {0} is substituted with the username > usersearch: ‘(uid={0})’ > # Use this attribute from the user as username (if not set then DN is used) > username\_attribute: null > authz: > roles\_from\_myldap: > enabled: false > authorization\_backend: > # LDAP authorization backend (gather roles from a LDAP or Active Directory, you have to configure the above LDAP authentication backend settings too) > type: ldap # NOT FREE FOR COMMERCIAL USE > config: > # enable ldaps > enable\_ssl: false > # enable start tls, enable\_ssl should be false > enable\_start\_tls: false > # send client certificate > enable\_ssl\_client\_auth: false > # verify ldap hostname > verify\_hostnames: true > hosts: > - localhost:8389 > bind\_dn: null > password: null > rolebase: ‘ou=groups,dc=example,dc=com’ > # Filter to search for roles (currently in the whole subtree beneath rolebase) > # {0} is substituted with the DN of the user > # {1} is substituted with the username > # {2} is substituted with an attribute value from user’s directory entry, of the authenticated user. Use userroleattribute to specify the name of the attribute > rolesearch: ‘(uniqueMember={0})’ > # Specify the name of the attribute which value should be substituted with {2} above > userroleattribute: null > # Roles as an attribute of the user entry > userrolename: memberOf > # The attribute in a role entry containing the name of that role > rolename: cn > # Resolve nested roles transitive (roles which are members of other roles and so on …) > resolve\_nested\_roles: true > roles\_from\_another\_ldap: > enabled: false > authorization\_backend: > type: ldap # NOT FREE FOR COMMERCIAL USE > #config goes here … If you can help me to solve this, thanks 😉 Regards ---
**Author:** ![searchguard\_google\_group](https://sea1.discourse-cdn.com/flex019/user_avatar/forum.search-guard.com/searchguard_google_group/32/462_2.png) [@searchguard\_google\_group](https://forum.search-guard.com/u/searchguard_google_group)\ **Post date:** [June 15, 2016, 4:48pm UTC](https://forum.search-guard.com/t/basic-auth-exception-with-bad-username-password-and-response-is-empty/197/2 "2016-06-15T16:48:21Z")
A 401 is sent but with no WWW-Auhtenticate header. Will look into this, thx curl -k -vv -Ss -u wrong:wrong [https://localhost:9200](https://localhost:9200) \* Rebuilt URL to: [https://localhost:9200/](https://localhost:9200/) \* Trying ::1... \* Connected to localhost (::1) port 9200 (#0) \* TLS 1.2 connection using TLS\_DHE\_RSA\_WITH\_AES\_128\_CBC\_SHA256 \* Server certificate: node-0.example.com \* Server certificate: Example Com Inc. Signing CA \* Server certificate: Example Com Inc. Root CA \* Server auth using Basic with user 'wrong' > GET / HTTP/1.1 > Host: localhost:9200 > Authorization: Basic d3Jvbmc6d3Jvbmc= > User-Agent: curl/7.43.0 > Accept: \*/\* \< HTTP/1.1 401 Unauthorized \< Content-Type: text/plain; charset=UTF-8 \< Content-Length: 0 \< \* Connection #0 to host localhost left intact > **···** > > > Am 15.06.2016 um 18:17 schrieb ll@ooworx.com: > > > > Hello, > > > > I'm trying to setup search-guard right now, basic auth is working but if I use wrong username or password I have this into elasticsearch.log : > > > > [2016-06-15 18:21:16,302][ERROR][com.floragunn.searchguard.auth.BackendRegistry] Unexpected exception com.google.common.util.concurrent.UncheckedExecutionException: ElasticsearchSecurityException[dsqdksqlk not found] > > com.google.common.util.concurrent.UncheckedExecutionException: ElasticsearchSecurityException[dsqdksqlk not found] > >     at com.google.common.cache.LocalCache$Segment.get(LocalCache.java:2203) > >     at com.google.common.cache.LocalCache.get(LocalCache.java:3937) > >     at com.google.common.cache.LocalCache$LocalManualCache.get(LocalCache.java:4739) > >     at com.floragunn.searchguard.auth.BackendRegistry.authenticate(BackendRegistry.java:379) > >     at com.floragunn.searchguard.filter.SearchGuardRestFilter.process(SearchGuardRestFilter.java:54) > >     at org.elasticsearch.rest.RestController$ControllerFilterChain.continueProcessing(RestController.java:263) > >     at org.elasticsearch.rest.RestController.dispatchRequest(RestController.java:176) > >     at org.elasticsearch.http.HttpServer.internalDispatchRequest(HttpServer.java:128) > >     at org.elasticsearch.http.HttpServer$Dispatcher.dispatchRequest(HttpServer.java:86) > >     at org.elasticsearch.http.netty.NettyHttpServerTransport.dispatchRequest(NettyHttpServerTransport.java:449) > >     at org.elasticsearch.http.netty.HttpRequestHandler.messageReceived(HttpRequestHandler.java:61) > >     at org.jboss.netty.channel.SimpleChannelUpstreamHandler.handleUpstream(SimpleChannelUpstreamHandler.java:70) > >     at org.jboss.netty.channel.DefaultChannelPipeline.sendUpstream(DefaultChannelPipeline.java:564) > >     at org.jboss.netty.channel.DefaultChannelPipeline$DefaultChannelHandlerContext.sendUpstream(DefaultChannelPipeline.java:791) > >     at org.elasticsearch.http.netty.pipelining.HttpPipeliningHandler.messageReceived(HttpPipeliningHandler.java:60) > >     at org.jboss.netty.channel.SimpleChannelHandler.handleUpstream(SimpleChannelHandler.java:88) > >     at org.jboss.netty.channel.DefaultChannelPipeline.sendUpstream(DefaultChannelPipeline.java:564) > >     at org.jboss.netty.channel.DefaultChannelPipeline$DefaultChannelHandlerContext.sendUpstream(DefaultChannelPipeline.java:791) > >     at org.jboss.netty.handler.codec.http.HttpChunkAggregator.messageReceived(HttpChunkAggregator.java:145) > >     at org.jboss.netty.channel.SimpleChannelUpstreamHandler.handleUpstream(SimpleChannelUpstreamHandler.java:70) > >     at org.jboss.netty.channel.DefaultChannelPipeline.sendUpstream(DefaultChannelPipeline.java:564) > >     at org.jboss.netty.channel.DefaultChannelPipeline$DefaultChannelHandlerContext.sendUpstream(DefaultChannelPipeline.java:791) > >     at org.jboss.netty.handler.codec.http.HttpContentDecoder.messageReceived(HttpContentDecoder.java:108) > >     at org.jboss.netty.channel.SimpleChannelUpstreamHandler.handleUpstream(SimpleChannelUpstreamHandler.java:70) > >     at org.jboss.netty.channel.DefaultChannelPipeline.sendUpstream(DefaultChannelPipeline.java:564) > >     at org.jboss.netty.channel.DefaultChannelPipeline$DefaultChannelHandlerContext.sendUpstream(DefaultChannelPipeline.java:791) > >     at org.jboss.netty.channel.Channels.fireMessageReceived(Channels.java:296) > >     at org.jboss.netty.handler.codec.frame.FrameDecoder.unfoldAndFireMessageReceived(FrameDecoder.java:459) > >     at org.jboss.netty.handler.codec.replay.ReplayingDecoder.callDecode(ReplayingDecoder.java:536) > >     at org.jboss.netty.handler.codec.replay.ReplayingDecoder.messageReceived(ReplayingDecoder.java:435) > >     at org.jboss.netty.channel.SimpleChannelUpstreamHandler.handleUpstream(SimpleChannelUpstreamHandler.java:70) > >     at org.jboss.netty.channel.DefaultChannelPipeline.sendUpstream(DefaultChannelPipeline.java:564) > >     at org.jboss.netty.channel.DefaultChannelPipeline$DefaultChannelHandlerContext.sendUpstream(DefaultChannelPipeline.java:791) > >     at org.elasticsearch.common.netty.OpenChannelsHandler.handleUpstream(OpenChannelsHandler.java:75) > >     at org.jboss.netty.channel.DefaultChannelPipeline.sendUpstream(DefaultChannelPipeline.java:564) > >     at org.jboss.netty.channel.DefaultChannelPipeline.sendUpstream(DefaultChannelPipeline.java:559) > >     at org.jboss.netty.channel.Channels.fireMessageReceived(Channels.java:268) > >     at org.jboss.netty.channel.Channels.fireMessageReceived(Channels.java:255) > >     at org.jboss.netty.channel.socket.nio.NioWorker.read(NioWorker.java:88) > >     at org.jboss.netty.channel.socket.nio.AbstractNioWorker.process(AbstractNioWorker.java:108) > >     at org.jboss.netty.channel.socket.nio.AbstractNioSelector.run(AbstractNioSelector.java:337) > >     at org.jboss.netty.channel.socket.nio.AbstractNioWorker.run(AbstractNioWorker.java:89) > >     at org.jboss.netty.channel.socket.nio.NioWorker.run(NioWorker.java:178) > >     at org.jboss.netty.util.ThreadRenamingRunnable.run(ThreadRenamingRunnable.java:108) > >     at org.jboss.netty.util.internal.DeadLockProofWorker$1.run(DeadLockProofWorker.java:42) > >     at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1142) > >     at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:617) > >     at java.lang.Thread.run(Thread.java:745) > > Caused by: ElasticsearchSecurityException[dsqdksqlk not found] > >     at com.floragunn.searchguard.auth.internal.InternalAuthenticationBackend.authenticate(InternalAuthenticationBackend.java:94) > >     at com.floragunn.searchguard.auth.BackendRegistry$4.call(BackendRegistry.java:383) > >     at com.floragunn.searchguard.auth.BackendRegistry$4.call(BackendRegistry.java:379) > >     at com.google.common.cache.LocalCache$LocalManualCache$1.load(LocalCache.java:4742) > >     at com.google.common.cache.LocalCache$LoadingValueReference.loadFuture(LocalCache.java:3527) > >     at com.google.common.cache.LocalCache$Segment.loadSync(LocalCache.java:2319) > >     at com.google.common.cache.LocalCache$Segment.lockedGetOrLoad(LocalCache.java:2282) > >     at com.google.common.cache.LocalCache$Segment.get(LocalCache.java:2197) > >     ... 47 more > > [2016-06-15 18:21:16,302][INFO][com.floragunn.searchguard.auth.BackendRegistry] Cannot authenticate user (or add roles) with ad 0 due to ElasticsearchSecurityException[com.google.common.util.concurrent.UncheckedExecutionException: ElasticsearchSecurityException[dsqdksqlk not found]]; nested: UncheckedExecutionException[ElasticsearchSecurityException[dsqdksqlk not found]]; nested: ElasticsearchSecurityException[dsqdksqlk not found];, try next > > > > As you can see "Unexpected exception" is sent and elasticsearch respond an empty body and header. > > > > I think if user or password not match, plugin should ask again for new credentials and send back correct answer like http 401.... > > > > Here my sg\_config.yml : > > > > searchguard: > >   dynamic: > >     http: > >       anonymous\_auth\_enabled: false > >       xff: > >         enabled: false > >         internalProxies: '192\.168\.0\.10|192\.168\.0\.11' # regex pattern > >         #internalProxies: '.\*' # trust all internal proxies, regex pattern > >         remoteIpHeader: 'x-forwarded-for' > >         proxiesHeader: 'x-forwarded-by' > >         #trustedProxies: '.\*' # trust all external proxies, regex pattern > >         ###### see [Pattern (Java Platform SE 7 )](https://docs.oracle.com/javase/7/docs/api/java/util/regex/Pattern.html) for regex help > >         ###### more information about XFF [X-Forwarded-For - Wikipedia](https://en.wikipedia.org/wiki/X-Forwarded-For) > >         ###### and here [RFC 7239 - Forwarded HTTP Extension](https://tools.ietf.org/html/rfc7239) > >         ###### and [Apache Tomcat 8 Configuration Reference (8.0.53) - The Valve Component](https://tomcat.apache.org/tomcat-8.0-doc/config/valve.html#Remote_IP_Valve) > >     authc: > >       kerberos\_auth\_domain: > >         enabled: false > >         order: 0 > >         http\_authenticator: > >           type: kerberos # NOT FREE FOR COMMERCIAL USE > >           challenge: true > >           config: > >             # If true a lot of kerberos/security related debugging output will be logged to standard out > >             krb\_debug: false > >             # Acceptor (Server) Principal name, must be present in acceptor\_keytab\_path file > >             acceptor\_principal: 'HTTP/localhost' > >             # If true then the realm will be stripped from the user name > >             strip\_realm\_from\_principal: true > >         authentication\_backend: > >           type: noop > >       basic\_internal\_auth\_domain: > >         enabled: true > >         order: 0 > >         http\_authenticator: > >           type: basic > >           challenge: true > >         authentication\_backend: > >           type: intern > >       proxy\_auth\_domain: > >         enabled: false > >         order: 2 > >         http\_authenticator: > >           type: proxy > >           challenge: false > >           config: > >             user\_header: "x-proxy-user" > >             roles\_header: "x-proxy-roles" > >         authentication\_backend: > >           type: noop > >       clientcert\_auth\_domain: > >         enabled: false > >         order: 4 > >         http\_authenticator: > >           type: clientcert > >           challenge: false > >         authentication\_backend: > >           type: noop > >       ldap: > >         enabled: false > >         order: 3 > >         http\_authenticator: > >           type: basic > >           challenge: false > >         authentication\_backend: > >           # LDAP authentication backend (authenticate users against a LDAP or Active Directory) > >           type: ldap # NOT FREE FOR COMMERCIAL USE > >           config: > >             # enable ldaps > >             enable\_ssl: false > >             # enable start tls, enable\_ssl should be false > >             enable\_start\_tls: false > >             # send client certificate > >             enable\_ssl\_client\_auth: false > >             # verify ldap hostname > >             verify\_hostnames: true > >             hosts: > >               - localhost:8389 > >             bind\_dn: null > >             password: null > >             userbase: 'ou=people,dc=example,dc=com' > >             # Filter to search for users (currently in the whole subtree beneath userbase) > >             # {0} is substituted with the username > >             usersearch: '(uid={0})' > >             # Use this attribute from the user as username (if not set then DN is used) > >             username\_attribute: null > >     authz: > >       roles\_from\_myldap: > >         enabled: false > >         authorization\_backend: > >           # LDAP authorization backend (gather roles from a LDAP or Active Directory, you have to configure the above LDAP authentication backend settings too) > >           type: ldap # NOT FREE FOR COMMERCIAL USE > >           config: > >             # enable ldaps > >             enable\_ssl: false > >             # enable start tls, enable\_ssl should be false > >             enable\_start\_tls: false > >             # send client certificate > >             enable\_ssl\_client\_auth: false > >             # verify ldap hostname > >             verify\_hostnames: true > >             hosts: > >               - localhost:8389 > >             bind\_dn: null > >             password: null > >             rolebase: 'ou=groups,dc=example,dc=com' > >             # Filter to search for roles (currently in the whole subtree beneath rolebase) > >             # {0} is substituted with the DN of the user > >             # {1} is substituted with the username > >             # {2} is substituted with an attribute value from user's directory entry, of the authenticated user. Use userroleattribute to specify the name of the attribute > >             rolesearch: '(uniqueMember={0})' > >             # Specify the name of the attribute which value should be substituted with {2} above > >             userroleattribute: null > >             # Roles as an attribute of the user entry > >             userrolename: memberOf > >             # The attribute in a role entry containing the name of that role > >             rolename: cn > >             # Resolve nested roles transitive (roles which are members of other roles and so on ...) > >             resolve\_nested\_roles: true > >       roles\_from\_another\_ldap: > >         enabled: false > >         authorization\_backend: > >           type: ldap # NOT FREE FOR COMMERCIAL USE > >           #config goes here ... > > > > If you can help me to solve this, thanks 😉 > > > > Regards > > > > -- > > You received this message because you are subscribed to the Google Groups "Search Guard" group. > > To unsubscribe from this group and stop receiving emails from it, send an email to search-guard+unsubscribe@googlegroups.com. > > To post to this group, send email to search-guard@googlegroups.com. > > To view this discussion on the web visit [https://groups.google.com/d/msgid/search-guard/bf9717af-204a-44fe-ae9a-975969bd60f6%40googlegroups.com\](https://groups.google.com/d/msgid/search-guard/bf9717af-204a-44fe-ae9a-975969bd60f6%40googlegroups.com%5C). > > For more options, visit [https://groups.google.com/d/optout\](https://groups.google.com/d/optout%5C).